Skip to main content
Autopilot connects to your database with a read-only user, the same way analytics platforms do. Setup is two SQL statements and a connection string. During onboarding we do this together on a call; this page is what your database team needs to prepare ahead of time.
On Supabase? Logical replication is already enabled on Supabase projects. You only need to create the user below in the SQL editor and share the direct connection string.

​
Requirements

  • PostgreSQL 14 or newer. Supabase, Neon, Amazon RDS and Aurora, Google Cloud SQL, and most managed providers qualify.
  • Logical replication enabled. This is the built-in PostgreSQL setting that exposes the change feed Autopilot reads, and the same setting analytics tools such as Fivetran and Airbyte ask for. See Enable logical replication below.
  • A direct connection host. Use your provider’s direct database host (typically port 5432), not a transaction pooler host. Pooled connections cannot follow the change feed.
If you are unsure whether your provider qualifies, ask us and we will check with you.

​
Enable logical replication

​
Create the Autopilot user

Run these two statements as a role that can create roles (for example postgres), replacing <SECRET_PASSWORD> with a strong, unique password:
What this gives Autopilot, and nothing more:
  • Read access to your tables, through pg_read_all_data, the read-only role built into PostgreSQL.
  • Permission to follow the change feed, through REPLICATION.
The user can’t insert, update, delete, or alter anything, and can’t create databases or other users. Dreamlit never modifies your data.
It is best practice to create a separate database user for each service that connects to your database. That way you can see exactly what each one is allowed to do, and revoke any of them independently.

​
Share the connection string

Put the user and password into a standard connection string using your direct database host:
SSL is always on for Autopilot connections, with the certificate verified. You do not need to add any SSL parameters to the string. Share it with us through the onboarding form or your Dreamlit dashboard. Credentials are encrypted at rest and never displayed in plaintext. See Security for the full picture.
Contact support and we will share the addresses Autopilot connects from.
Tell us during onboarding. Row level security applies to queries, not to the change feed, so Autopilot handles RLS-protected tables differently. We’ll go through which tables your funnel needs and agree on how to include them.
Autopilot can read signups and logins from Supabase Auth’s tables the same way it reads the rest of your database. If you also want Dreamlit to send your auth emails (magic links, password resets), that is set up separately; see the Supabase Auth emails guide.

​
Removing access

You can revoke Autopilot’s access at any time, in two steps.
Remove the connection first. Remove it in your Dreamlit dashboard, or ask us to, before dropping the user. Dropping the user while the connection is still active leaves Autopilot’s place in the change feed open, and your database keeps holding on to change history it no longer needs.
Once the connection is removed, drop the user:
Last validated: 2026-09-08